GCP resources are organized into projects -- all resource IDs and IAM
principles are grouped under a project ID. This means that by default roles
assigned to a principle (e.g. a user or service account) are scoped only to
project resources. This can be tricky if say your images are in one project's
storage bucket and your app is running in another

If you want to provide a service principle in one project access to resources
in another , the approach is not obvious, nor is it well documented.

Below we'll talk about the most direct way, which works for projects …